CVE-2021-32806

Katalog CVE

CVSS 6.1 · Medium EPSS 1,0%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada plone isurlinportal. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vulnerability. Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe to redirect to a url. A url like `https://example.org` is not in the portal. The url `https:example.org` without slashes is considered to be in the portal. When redirecting, some browsers go to `https://example.org`, others give an error. Attackers may use this to redirect victims to their site, especially as part of a phishing attack. The problem has been patched in Products.isurlinportal 1.2.0.

Rincian

Terbit di NVD

2 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/plone/Products.isurlinportal/commit/d4fd34990d18adf05a10dc5e2bb4b066798280ba patch · advisory pihak ketiga
• http://jvn.jp/en/jp/JVN50804280/index.html advisory pihak ketiga
• https://github.com/plone/Products.isurlinportal/security/advisories/GHSA-q3m9-9fj2-mfwr advisory pihak ketiga